CompTIA CySA+ (CS0-002) Cert Prep: 6 Incident Response

Course details

Review essential incident response concepts and best practices as you study for the CompTIA Cybersecurity Analyst (CySA+) (CS0-002) exam. In this installment of the CySA+ (CS0-002) Cert Prep series, instructor Mike Chapple discusses how to classify threats and assess the impact of cybersecurity incidents as he prepares you for the exam. Mike covers the importance of communication during a cybersecurity incident response effort, the symptoms of an incident in progress, the use of forensic tools, and the incident recovery process. After completing this course, you'll be prepared to tackle the Incident Response domain of the CySA+ (CS0-002) exam.

Concepts

0. Introduction

01 - Incident response
02 - What you need to know
03 - Study resources

1. Assessing Incidents

04 - Identifying and classifying security incidents
05 - Threat classification
06 - Zero days and the advanced persistent threat
07 - Determining incident severity

2. Incident Response Process

08 - Build an incident response program
09 - Creating an incident response team
10 - Incident communications plan
11 - Incident identification
12 - Escalation and notification
13 - Mitigation
14 - Containment techniques
15 - Incident eradication and recovery
16 - Validation
17 - Post-incident activities

3. Indicators of Compromise

18 - Network symptoms
19 - Rogue access points and evil twins
20 - Endpoint symptoms
21 - Application symptoms

4. Forensic Investigations

22 - Conducting investigations
23 - Evidence types
24 - Introduction to forensics
25 - System and file forensics
26 - File carving
27 - Creating forensic images
28 - Digital forensics toolkit
29 - Operating system analysis
30 - Password forensics
31 - Network forensics
32 - Software forensics
33 - Mobile device forensics
34 - Embedded device forensics
35 - Chain of custody
36 - Ediscovery and evidence production

Conclusion

37 - Next steps

CompTIA CySA+ (CS0-002) Cert Prep: 6 Incident Response

Authors

Mike Chapple